Privacy Policy: Assets Out for Jira Service Management
Last updated: 2026-10-13
Assets Out for Jira Service Management ("the app") is an Atlassian Forge app for Jira Cloud, published by Plainwork Apps ("the developer"). It adds an Assets Export page in Jira where a user selects an Assets object schema and object types and downloads them as a ZIP file in their browser. The app only reads data; it does not create, change, or delete anything in Jira or Assets.
Summary
- The app has no developer-operated backend. Its interface runs in your browser inside Jira, is hosted on Atlassian Forge, and calls Jira through Forge Bridge.
- The app has no developer-operated data collection endpoint and does not send Jira or Assets data to the developer or an external service.
- Installing the app does not give the developer a separate account or access to your Jira site.
- The app stores no data. Export files are created in the browser and saved to the user's device; the developer never receives them.
Data the app accesses
The app reads this data from your site's Assets, using the permissions of the signed-in user:
| Data | Why |
|---|---|
| Assets workspace ID | To address the Assets REST API of the site |
| Object schemas: ID, name, key, and object count | To list the schemas the user can export |
| Object types: ID, name, and parent type | To list and order the types in a schema |
| Attribute definitions of the selected types, including options, allowed statuses, and reference settings | To read attribute values and describe the export |
| Object counts per type, with the user's AQL filter if one is set | To show the export size and check that the export is complete |
| Objects of the selected types, with their attribute values | The content of the export |
| Forge context provided by Forge, such as locale and site identifiers | To run the app inside Jira |
The Assets object endpoints return more than the app writes to the export. Their responses can include avatar data with media access tokens, and, for user attributes, account IDs, display names, and email addresses when Assets makes them available. The responses are received in browser memory. The export does not contain avatars, media access tokens, or email addresses.
Requests are read-only. The app uses GET requests and POST requests to the Assets AQL search and AQL count endpoints, which return data without changing it.
Data the app stores
None. The application code does not persist Jira or Assets data to Forge storage, a separate database, cookies, or browser local storage, and does not implement logging of that data, analytics, or tracking. Data and API responses are held in browser memory while the page is open. The browser may cache the app's static files; Jira and Forge manage their own authentication and platform operations.
Export files
An export is a ZIP file that the browser generates and saves to the user's device. Depending on the selection, it contains:
- object IDs, keys, labels, created and updated dates, and attribute values;
- for user attributes, the Atlassian account ID and display name of the referenced users;
- the schema, object types, and attribute definitions;
- export details: workspace ID, export date, app version, and the AQL filter, if one was used.
Export files can contain business data and personal data from your Assets. Once downloaded, a file is outside the app, Jira, and the developer's reach. Your organization and the user who downloads it decide how it is stored, shared, and deleted, and are responsible for doing so in line with their own policies and applicable law.
Permissions (scopes)
| Scope | Use |
|---|---|
read:servicedesk-request | Find the Assets workspace ID of the site |
read:cmdb-schema:jira | List object schemas |
read:cmdb-type:jira | List object types |
read:cmdb-attribute:jira | Read attribute definitions |
read:cmdb-object:jira | Search and count objects |
All requests use Forge Bridge requestJira on behalf of the signed-in user. Access is limited by both the app's declared scopes and that user's Assets permissions, so a user can export only what they can already see in Assets. The app has no write scopes.
Sharing and third parties
The app does not transmit Jira or Assets data to the developer or external services. It does not sell data or use it for advertising. If you contact the developer and supply information in a support request, that information is separate from the app's automatic data processing.
Your data is processed by Atlassian (Jira, Assets, and Forge) under your agreement with Atlassian. See the Atlassian Privacy Policy.
Data retention and deletion
The app has no developer-operated data store and stores nothing on your site. Assets data is held in browser memory during use and is released when the page is closed or reloaded. Uninstalling the app removes its access; there is no app data to delete. Atlassian controls retention of Jira data and platform records under your agreement with Atlassian. Retention and deletion of downloaded export files is up to your organization.
Security
The app calls Jira through Atlassian's Forge Bridge over HTTPS. It has no developer-operated server and does not require users to provide API tokens. Authentication for those requests is managed by Jira and Forge.
Children
The app is a workplace tool and is not directed at children.
Changes to this policy
If the app's data handling changes, for example if a backend is added, this policy will be updated and the date above changed.